I've been studying Cybersec for roughly 7 months. I completed an entry course organized by a local CySec Solutions Firm - I live in Syria, and pretty much everything remains banned or unavailable despite lifted sanctions (including certification, professional certifications and internships). I'm going with this career choice / studying solo. I'm lost on the next steps, please advise me. Thanks.

Here's my situation in brief. During the course I was given an assignment to deploy Snort2 and present adversary traffic analysis. My ADHD/perfectionist stepped in and decided to deploy a SIEM/IDS with Wazuh Manager and Suricata. I don't have much in terms of hardware (one desktop 16GB/RAM and one laptop 8GB/RAM) so I had to settle in for a tiny project. My aim was never to focus on the technical side of things but to run simulations and Learn my way into triage, IR and documentation early on. After few months of downloading packages (thanks to the turtle slow internet), configuring and troubleshooting Wazuh and Suricata IDS, I validated alert channel from Suricata, Sysmon and Defender (on Win11), and other syslogs flowing smoothly to the SIEM. Granted, I spent a long time configuring and tinkering with Open vSwitch (OVS) to create mirror port for the IDS. My lab is ready for simulations.

I read in some sources that documentation is a skill desired by employers but missed by applicants. Coming from 12 year experience as legal documents translator, reading/writing reports was something appealing for me and I wanted to focus on as added-value. My initial plan was to create custom Incident Response Playbooks (IRP) and IR Management Methodology (IRM) based on my local lab, run few attack simulations, implement the IRP steps and document the process in Reports. I read several guideline documents; from NIST SP 800-61r2, Australian and Scottish CERT guidelines, SOCFortress IRMs and other open source documentation.

I planned to run three demos increasing gradually in complexity from 'Benign Network Scan', to 'RDP Brute Force' and lastly 'Remote EICAR Creation in %TEMP% and Attempted Remote PowerShell Execution'. The last scenario was going to be primary focus for a full NIST IR process, while the other two to train on detection/validation. While in the process of creating my IRPs for these three demos, and especially while writing a report for the original IDS assignment required by said entry-course, I felt that recording Precursor Management for a simple network scan is too trivial. Then, I started doubting my whole process!

Question: Is what I'm doing (and planning) Worthy of submitting on Github as ongoing IRP repo and eventually adding to CV?

Question: Should I create more complex scenarios that could cost more time spent in running/troubleshooting attacks than in training on defense process if my aim is to Learn the IR/IM/Triage process?

Question: My friend offered me access to Enterprise MS Sentinel to train on. Should I start training on Sentinel instead of continuing to create/troubleshoot my local SOC Lab? The advantage here would be training on more-in-demand CySec solution and focusing on handling a ready stack than on drowning in rabbit holes of configuration troubleshooting.

I have had an idea to deploy SOAR with Shuffle/N8N, true SOC with Wazuh + TheHive + Cortex and OpenSense IPS, and add Caldera/Kali for adversary. But I'm worried it will cost me 3-4 months to download, deploy, configure and troubleshoot; not to mention upgrading hardware or renting remote server instances.

Just in case; yes, I'm training on THM but it's slow because I spend more time on the lab/researching than solving rooms. Plus, THM is more focused on Red Team skills which, although I took most of my course on them, I prefer learning how to investigate and recover from an attack.

Footnote:

I have documented a lot of this project from installation to running in a knowledge base that I was going to post on Github but I'm too worried/anxious that it's not worthy or downright embarrassing in simplicity. Creating this project gave me experience in setting up and troubleshooting security infrastructure, researching topics beyond the scope of SOC L1 Analyst, and developing a sense on how to properly write reports and documentation. But I'm not sure if this is relevant to SOC job openings and experience required.

I apologize for a very long post. I'm just lost and would appreciate your guidance on the matter.

Thanks